Which of the following is the proper way to quantify the total monetary damage resulting from an exploited vulnerability?